*This patch series adds support for a read-only squashfs based root filesystem wit SWUpdate support and secureboot.
The build is somewhat complex as we need the output of dm-verity to generate the initramfs. The build is split in the following steps 1. Build the root file system 2. Generate a squashfs image - this can also be replace by another image format(e.g. ext4) 3. Build from the image the dm-verity partition and add it to the end of the image 4. Add the resulting verity environment to the initrd 5. Build the signed efi tool chain.
This series needs SWUpdate 2021.11. The necessary changes are currently backported.
Changes in RFC V2: - rebase onto orgin/next - adapt Kconfig to new ebg-secure-boot-snakeoil.yml by deleting unnecessary options - Cleanup to support different file-systems for verity-img - tested with ext4 and squashfs - simplified kernel patching - prepend not necessary - added flag to enable/disable - whitespaces for readability - integrated into ebg-secure-boot-snakeoil - make behavior on corruption configurable during build time. - default is restart on corruption - add ISAR patch for correct permissions
Changes in RFC V3: - Configurable size of /tmp - remove unnecessary overlay-parse-etc.service - convert etc-sysusers to drop in configuration of systemd-sysusers.service - extend commit messages
Changes in Patch: - rebased onto origin/next 2550c34a03ae3c035a1593585f2d8e545c83140d - initrd verity warning message - Kconfig: secure-boot element selects also swupdate as the secureboot kas option contains swupdate - fixed ci build
Quirin Gylstorff (9): Add new class to create a squashfs based root file system Add verity-img.bbclass for dm-verity based rootfs linux-cip-common: Increase revision kernel config Create a initrd with support for dm-verity Create an read-only rootfs with dm-verity Create systemd mount units for a etc overlay Mount writable home partition kas: Patch isar for correct permissions in var and home swupdate: Backport patches from SWUpdate Master
*This patch series adds support for a read-only squashfs based root filesystem wit SWUpdate support and secureboot.
The build is somewhat complex as we need the output of dm-verity to generate the initramfs. The build is split in the following steps 1. Build the root file system 2. Generate a squashfs image - this can also be replace by another image format(e.g. ext4) 3. Build from the image the dm-verity partition and add it to the end of the image 4. Add the resulting verity environment to the initrd 5. Build the signed efi tool chain.
This series needs SWUpdate 2021.11. The necessary changes are currently backported.
Changes in RFC V2: - rebase onto orgin/next - adapt Kconfig to new ebg-secure-boot-snakeoil.yml by deleting unnecessary options - Cleanup to support different file-systems for verity-img - tested with ext4 and squashfs - simplified kernel patching - prepend not necessary - added flag to enable/disable - whitespaces for readability - integrated into ebg-secure-boot-snakeoil - make behavior on corruption configurable during build time. - default is restart on corruption - add ISAR patch for correct permissions
Changes in RFC V3: - Configurable size of /tmp - remove unnecessary overlay-parse-etc.service - convert etc-sysusers to drop in configuration of systemd-sysusers.service - extend commit messages
Changes in Patch: - rebased onto origin/next 2550c34a03ae3c035a1593585f2d8e545c83140d - initrd verity warning message - Kconfig: secure-boot element selects also swupdate as the secureboot kas option contains swupdate - fixed ci build
Quirin Gylstorff (9): Add new class to create a squashfs based root file system Add verity-img.bbclass for dm-verity based rootfs linux-cip-common: Increase revision kernel config Create a initrd with support for dm-verity Create an read-only rootfs with dm-verity Create systemd mount units for a etc overlay Mount writable home partition kas: Patch isar for correct permissions in var and home swupdate: Backport patches from SWUpdate Master
